CVE-2026-11818: WPCafe Authorization Bypass Lets Subscribers Modify Notification Workflows

Technical summary

CVE-2026-11818 is an authorization bypass vulnerability in WPCafe plugin versions up to 3.0.14. The plugin fails to implement proper role-based access controls on REST API endpoints that manage notification flow workflows. While the endpoints perform a wp_rest nonce verification, this nonce is retrievable by any logged-in user from frontend page source, and the plugin does not validate user capabilities (e.g., administrator role) before permitting create, read, update, delete, clone, or bulk-delete operations on workflows. The vulnerability is classified under CWE-862 (Missing Authorization), indicating absent or incomplete capability checks on sensitive operations.

Business impact

An attacker with subscriber-level access—which could include a disgruntled employee, former contractor, or compromised account—can disrupt restaurant operations by modifying or deleting critical notification workflows. This could disable order alerts, reservation confirmations, or customer notifications, leading to missed orders, poor customer experience, and operational confusion. In multi-tenant or agency scenarios, a compromised subscriber account on one restaurant's site could also affect workflow configurations for other managed properties. The impact is primarily on data integrity and operational continuity rather than confidentiality.

Affected systems

WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress in all versions up to and including 3.0.14 is affected. Any WordPress site using this plugin with default or custom user roles allowing subscriber access is at risk. The vulnerability applies regardless of how the plugin is deployed (single restaurant site, multi-location setup, or agency managed).

Exploitability

Exploitability is straightforward and requires only a valid subscriber-level account and basic understanding of REST API calls. The nonce required for requests is publicly accessible in the frontend HTML source, eliminating that as a barrier. An attacker does not need admin credentials, special plugins, or complex reconnaissance—a standard login and use of browser developer tools or curl commands suffice. The CVSS score of 5.4 (Medium) reflects low attack complexity and low privilege requirements, though the impact is limited to integrity and availability of workflow data rather than broader system compromise.

Remediation

Site administrators should immediately update WPCafe to a patched version released after 3.0.14 (verify against the vendor advisory for the exact version number and release date). Until patching is possible, administrators should review subscriber-level user accounts and remove unnecessary subscribers with workflow management needs, limiting access to verified administrators only. Monitoring REST API logs for unauthorized workflow modifications can help detect active exploitation.

Patch guidance

Check the WPCafe plugin repository or vendor advisory for version 3.0.15 or later, which should include authorization checks validating that only administrators can manage notification workflows. Apply the update through the WordPress plugin dashboard once available. After updating, verify that subscriber accounts can no longer access the workflow management endpoints by attempting to list or modify workflows from a subscriber account. Test on a staging environment first if you have customizations relying on the plugin.

Detection guidance

Monitor REST API request logs for calls to workflow-related endpoints (typically /wp-json/wpcafe/*/notification* or similar paths) originating from non-administrator user IDs. Look for POST, PUT, DELETE, or PATCH requests from subscriber or contributor accounts. Enable WordPress security logging plugins (e.g., Wordfence, Sucuri) if not already in place; they flag unauthorized admin capability usage. Audit recent workflow modifications in the WPCafe admin panel to identify when changes occurred and correlate with user login times and IP addresses.

Why prioritize this

Although CVE-2026-11818 carries a Medium CVSS score, it merits prompt attention because authorization bypass vulnerabilities are attractive to both internal threats and external attackers who have gained low-level access. The ease of exploitation and the public visibility of the nonce in page source code make this a low-friction attack. For restaurants relying on WPCafe's notification workflows for operational efficiency, compromise could disrupt customer communication and order fulfillment. Prioritize patching for multi-user sites where subscriber accounts are distributed to staff or contractors.

Risk score, explained

The CVSS 3.1 score of 5.4 (Medium) is driven by low attack complexity (network-based, no special tools) and low privilege requirements (any authenticated user), balanced by limited scope (only workflow data), and no confidentiality impact. While the impact on availability and integrity is moderate, the vulnerability does not grant code execution or administrative takeover. Organizations running single-admin WordPress sites face lower risk than those with multiple subscriber accounts; those with distributed access should treat this as higher priority internally.

Frequently asked questions